Skip to content
Snippets Groups Projects
  1. Jun 23, 2015
    • Nick Kralevich's avatar
      Allow /dev/klog access, drop mknod and __null__ access · 31d88a70
      Nick Kralevich authored
      Allow vold, healthd, slideshow, and watchdogd access to /dev/kmsg.
      These processes log to the kernel dmesg ring buffer, so they need
      write access to that file.
      
      Addresses the following denials:
      
          avc: denied { write } for pid=134 comm="watchdogd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:watchdogd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
          avc: denied { write } for pid=166 comm="healthd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:healthd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
          avc: denied { write } for pid=180 comm="vold" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:vold:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
      
      These denials were triggered by the change in
      https://android-review.googlesource.com/151209 . Prior to that change,
      any code which called klog_init would (unnecessarily) create the
      device node themselves, rather than using the already existing device
      node.
      
      Drop special /dev/__null__ handling from watchdogd. As of
      https://android-review.googlesource.com/148288 , watchdogd no longer
      creates it's own /dev/null device, so it's unnecessary for us
      to allow for it.
      
      Drop mknod from healthd, slideshow, and watchdogd. healthd and slideshow
      only needed mknod to create /dev/__kmsg__, which is now obsolete.
      watchdogd only needed mknod to create /dev/__kmsg__ and /dev/__null__,
      which again is now obsolete.
      
      (cherry picked from e2651972)
      
      Bug: 21242418
      Change-Id: If01c8001084575e7441253f0fa8b4179ae33f534
      31d88a70
  2. Mar 31, 2015
    • Sami Tolvanen's avatar
      Fix block_suspend denial for slideshow · 5895ffe1
      Sami Tolvanen authored
      Add wakelock_use to slideshow.te to fix the following denial:
      
      avc:  denied  { block_suspend } for  pid=137 comm="slideshow" capability=36  scontext=u:r:slideshow:s0 tcontext=u:r:slideshow:s0 tclass=capability2 permissive=0
      
      Change-Id: If84f167cd235e8196eadf3fb85cc725a5ea464e6
      5895ffe1
  3. Feb 26, 2015
    • Sami Tolvanen's avatar
      Allow init to execute /sbin/slideshow · 9d87c647
      Sami Tolvanen authored
      Add rules to allow /sbin/slideshow to access framebuffer and input
      devices at early stages of boot, and rules to allow init to execute
      the program (from init.rc using exec).
      
      Needed by changes from
        I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d
      
      Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0
      9d87c647
Loading